docs: def create_subkey(primary_bytes, subkey, signer_func, secret_bytes=b''):
      """Export new subkey to GPG primary key."""
      subkey_packet = protocol.packet(tag=(7 if secret_bytes else 14),
                                      blob=(subkey.data() + secret_bytes))
      packets = list(decode.parse_packets(io.BytesIO(primary_bytes)))
      primary, user_id, signature = packets[:3]
  
      data_to_sign = primary['_to_hash'] + subkey.data_to_hash()
  
      if subkey.ecdh:
          embedded_sig = None
      else:
          # Primary Key Binding Signature
          hashed_subpackets = [
              protocol.subpacket_time(subkey.created)]  # signature time
          unhashed_subpackets = [
              protocol.subpacket(16, subkey.key_id())]  # issuer key id
          embedded_sig = protocol.make_signature(
              signer_func=signer_func,
              data_to_sign=data_to_sign,
              public_algo=subkey.algo_id,
              sig_type=0x19,
              hashed_subpackets=hashed_subpackets,
              unhashed_subpackets=unhashed_subpackets)
  
      # Subkey Binding Signature
  
      # Key flags: https://tools.ietf.org/html/rfc4880#section-5.2.3.21
      # (certify & sign)                   (encrypt)
      flags = (2) if (not subkey.ecdh) else (4 | 8)
  
      hashed_subpackets = [
          protocol.subpacket_time(subkey.created),  # signature time
          protocol.subpacket_byte(0x1B, flags)]
  
      unhashed_subpackets = []
      unhashed_subpackets.append(protocol.subpacket(16, primary['key_id']))
      if embedded_sig is not None:
          unhashed_subpackets.append(protocol.subpacket(32, embedded_sig))
      unhashed_subpackets.append(protocol.CUSTOM_SUBPACKET)
  
      if not decode.has_custom_subpacket(signature):
          signer_func = keyring.create_agent_signer(user_id['value'])
  
      signature = protocol.make_signature(
          signer_func=signer_func,
          data_to_sign=data_to_sign,
          public_algo=primary['algo'],
          sig_type=0x18,
          hashed_subpackets=hashed_subpackets,
          unhashed_subpackets=unhashed_subpackets)
      sign_packet = protocol.packet(tag=2, blob=signature)
      return primary_bytes + subkey_packet + sign_packet